“Windows protected your PC” about ojdkbuild HOT 5 CLOSED

Hi,

Yes, the problem is caused by the fact, that windows requires MSI installation packages to be crypto-signed by the publisher. For this a valid certificate (approved by Microsoft) is required.

Ojdkbuild MSIs published on GitHub are not going to be signed. SHA256 sums are published for them instead to check their integrity. SHA256 for each binary are published in two places, in download section (example) and inside project tree itself (example) so should not be that easy to tamper.

I think you can use one of two variants to fix that warning (if you want to distribute MSIs to end-users etc):

1. You may obtain a valid certificate for yourself (your company) and sign ojdkbuild MSIs (MSI binaries can be signed - rebuild is not required) before distributing them. Signing commands look like this:

signtool.exe" sign /v /s my /n "Company Name" /t "http://timestamp.verisign.com/scripts/timestamp.dll" path/to/jdk.msi
signtool.exe" verify /v /pa path/to/jdk.msi

2. You may use MSIs from Red Hat (warning: registration is required) that are signed by Red Hat key: https://developers.redhat.com/products/openjdk/download/

from ojdkbuild.

@ojdkbuild Is it hard to get an approved certificate?

Wouldn’t Microsoft give an approved certificate to an open-source community, such as ojdkbuild? Or does it cost money to be an approved publisher?

from ojdkbuild.

@waterlink , sorry, cannot answer neither of these questions - never tried to obtain such certificate myself.

from ojdkbuild.

from ojdkbuild.

Wouldn’t Microsoft give an approved certificate to an open-source community, such as ojdkbuild? Or does it cost money to be an approved publisher?

Microsoft does not hand code signing certificates directly, instead, many companies offer Windows code signing. Certum has a special offer for open source projects, but it's still not exactly cheap (€86 the first year since you need the reader and cryptographic card, then €28 per year).

from ojdkbuild.